docs/specs/fw_cfg.rst

5 Guest-side Hardware Interface
15 ---------------------------
19 * Width: 16-bit
20 * Endianness: little-endian (if IOport), or big-endian (if MMIO)
25 Setting the selector register will cause the data offset to be set
34 the selector value is between 0x4000-0x7fff or 0xc000-0xffff.
38       longer supported, and will be ignored (treated as no-ops)!
49 items are accessed with a selector value between 0x0000-0x7fff, and
51 value between 0x8000-0xffff.
54 -------------
58 * Width: 8-bit (if IOport), 8/16/32/64-bit (if MMIO)
59 * Endianness: string-preserving
72 will be set to zero. Each successful access to the data register will
80 An N-byte wide read of the data register will return the next available
85 ------------------
98 --------------
102 the guest-side firmware can not use ACPI to find fw_cfg. However, once the
105 inventory of in-use IOport or MMIO regions.
108 ----------------------------
119 Register returns 0x51454d5520434647 (``QEMU CFG`` in big-endian format).
124 A 32-bit little-endian unsigned int, this item is used to check for enabled
127 - Bit 0: traditional interface. Always set.
128 - Bit 1: DMA interface.
137 structure, which makes it easier for guest-side firmware to identify
142         uint32_t count;		/* number of entries, in big-endian format */
147         uint32_t size;		/* size of referenced fw_cfg item, big-endian */
148         uint16_t select;	/* selector key of fw_cfg item, big-endian */
150         char name[56];		/* fw_cfg item name, NUL-terminated ascii */
156 Please consult the QEMU source for the most up-to-date and authoritative list
168 0x0000 - 0x3fff  Generic (0x0000 - 0x3fff, generally RO, possibly RW through
170 0x4000 - 0x7fff  Generic (0x0000 - 0x3fff, RW, ignored in QEMU v2.4+)
171 0x8000 - 0xbfff  Arch. Specific (0x0000 - 0x3fff, generally RO, possibly RW
173 0xc000 - 0xffff  Arch. Specific (0x0000 - 0x3fff, RW, ignored in v2.4+)
179 Guest-side DMA Interface
182 If bit 1 of the feature bitmap is set, the DMA interface is present. This does
183 not replace the existing fw_cfg interface, it is an add-on. This interface
184 can be used through the 64-bit wide address register.
186 The address register is in big-endian format. The value for the register is 0
188 offset 4) triggers an operation. This means that operations with 32-bit
190 64-bit addresses can be triggered with one 64-bit write or two 32-bit writes,
207 - Bit 0: Error
208 - Bit 1: Read
209 - Bit 2: Skip
210 - Bit 3: Select. The upper 16 bits are the selected index.
211 - Bit 4: Write
213 When an operation is triggered, if the ``control`` field has bit 3 set, the
217 If the ``control`` field has bit 1 set, a read operation will be performed.
221 If the ``control`` field has bit 4 set (and not bit 1), a write operation will be
226 are dropped entirely. Writes to read-only items are also rejected. All of these
227 write errors set bit 0 (the error bit) in the ``control`` field.
229 If the ``control`` field has bit 2 set (and neither bit 1 nor bit 4), a skip
235 Error bit set
252     -fw_cfg [name=]<item_name>,file=<path>
256     -fw_cfg [name=]<item_name>,string=<string>
258 Since v5.1, QEMU allows some objects to generate fw_cfg-specific content,
259 the content is then associated with a "file" item using the 'gen_id' option
262     -object <generator-type>,id=<generated_id>,[generator-specific-options] \
263     -fw_cfg [name=]<item_name>,gen_id=<generated_id>
290 All externally provided fw_cfg items are read-only to the guest.